detection.wiki

Detection rules › Sigma

Potential CVE-2024-3400 Exploitation - Palo Alto GlobalProtect OS Command Injection

Status
test
Severity
high
Log source
product paloalto, category appliance, service globalprotect
Author
Nasreddine Bencherchali (Nextron Systems)
Source
github.com/SigmaHQ/sigma

Detects potential exploitation attempts of CVE-2024-3400 - an OS command injection in Palo Alto GlobalProtect. This detection looks for suspicious strings that indicate a potential directory traversal attempt or command injection.

MITRE ATT&CK coverage

TacticTechniques
Initial AccessNo specific technique
PersistenceNo specific technique
Privilege EscalationNo specific technique
StealthNo specific technique

Rule body yaml

title: Potential CVE-2024-3400 Exploitation - Palo Alto GlobalProtect OS Command Injection
id: f130a5f1-73ba-42f0-bf1e-b66a8361cb8f
status: test
description: |
    Detects potential exploitation attempts of CVE-2024-3400 - an OS command injection in Palo Alto GlobalProtect.
    This detection looks for suspicious strings that indicate a potential directory traversal attempt or command injection.
references:
    - https://security.paloaltonetworks.com/CVE-2024-3400
    - https://labs.watchtowr.com/palo-alto-putting-the-protecc-in-globalprotect-cve-2024-3400/
    - https://attackerkb.com/topics/SSTk336Tmf/cve-2024-3400/rapid7-analysis
author: Nasreddine Bencherchali (Nextron Systems)
date: 2024-04-18
modified: 2025-11-22
tags:
    - attack.initial-access
    - attack.persistence
    - attack.privilege-escalation
    - cve.2024-3400
    - detection.emerging-threats
    - attack.stealth
logsource:
    category: appliance
    product: paloalto
    service: globalprotect
    definition: 'Requirements: Palo Alto GlobalProtect "mp-log" and "gpsvc.log" log files need to be ingested'
detection:
    keywords_generic:
        - 'failed to unmarshal session(../'
        - 'failed to unmarshal session(./../'
        - 'failed to unmarshal session(/..'
        - 'failed to unmarshal session(%2E%2E%2F'
        - 'failed to unmarshal session(%2F%2E%2E'
        - 'failed to unmarshal session(%2E%2F%2E%2E%2F'
        - 'failed to unmarshal session(%252E%252E%252F'
        - 'failed to unmarshal session(%252F%252E%252E'
        - 'failed to unmarshal session(%252E%252F%252E%252E%252F'
    keywords_telemetry_exploit:
        - '{IFS}'
        - 'base64'
        - 'bash'
        - 'curl'
        - 'http'
    keywords_telemetry_path:
        - '/opt/panlogs/tmp/device_telemetry/'
    condition: keywords_generic or (keywords_telemetry_exploit and keywords_telemetry_path)
falsepositives:
    - Unknown
level: high

Stages and Predicates

Stage 0: condition

keywords_generic or (keywords_telemetry_exploit and keywords_telemetry_path)

Stage 1: keywords_generic

keywords_generic:
    - 'failed to unmarshal session(../'
    - 'failed to unmarshal session(./../'
    - 'failed to unmarshal session(/..'
    - 'failed to unmarshal session(%2E%2E%2F'
    - 'failed to unmarshal session(%2F%2E%2E'
    - 'failed to unmarshal session(%2E%2F%2E%2E%2F'
    - 'failed to unmarshal session(%252E%252E%252F'
    - 'failed to unmarshal session(%252F%252E%252E'
    - 'failed to unmarshal session(%252E%252F%252E%252E%252F'

Stage 2: keywords_telemetry_exploit

keywords_telemetry_exploit:
    - '{IFS}'
    - 'base64'
    - 'bash'
    - 'curl'
    - 'http'

Stage 3: keywords_telemetry_path

keywords_telemetry_path:
    - '/opt/panlogs/tmp/device_telemetry/'